Re:The Iran Firewall: A preliminary report
by aorth on Friday October 28, 2022 @12:11PM
(#33373362)
Wait I'm confused. I remember reading a bunch of reports about how China started blocking TLS 1.3 because of encrypted SNI (eSNI) years ago?
[ Parent
| on HN ]
Re:The Iran Firewall: A preliminary report
by dweekly on Friday October 28, 2022 @12:26PM
(#33373606)
I don't know anything about that (and I'm pretty sure TLS 1.3 doesn't mandate ECH since ECH isn't even finished standardizing!) but you can check to see if your browser supports ECH by visiting https://tls-ech.dev/
Re:The Iran Firewall: A preliminary report
by tialaramex on Friday October 28, 2022 @01:39PM
(#33374623)
Some people interested in the Great Firewall wrote up weirdness they saw with one particular prototype of eSNI years back. A game of Telephone later this became nonsense like "China blocks TLS 1.3" but actually if you do that what you get isn't web sites stripped of protection but connection errors. Which is indeed what happens for some sites from the other side of the Great Firewall, but we just say China blocks those sites, because that is what they do. Protocol versions are not crucial to them.
The current iteration of ECH is designed to be GREASEd which means browsers might just always do ECH with dummy values regardless, so either you block or you don't, you won't be able to selectively block ECH. This doesn't magically prevent the Great Firewall from working but does mean specifically host matching is degraded as intended.
Re:The Iran Firewall: A preliminary report
by 6502nerdface on Friday October 28, 2022 @07:59PM
(#33379548)
> A game of Telephone
Funny enough the children's "telephone game" is, in many Commonwealth countries, apparently called "Chinese whispers," at least according to my Londoner colleagues.